Apple’s recent implementation of a cap on vulnerability reports, a measure designed to combat a surge in AI-generated submissions, has inadvertently coincided with a significant macOS exploit potentially being missed. The tech giant’s security team, reportedly overwhelmed by a volume of AI-generated reports, many of which were fabricated, introduced the cap in June. This change also includes a 30-day cool-off period and requires researchers to apply for higher submission quotas.
This new system inadvertently prevented the cybersecurity startup Bynario from reporting a critical privilege escalation exploit chain for macOS. Bynario, which utilized OpenAI’s ChatGPT to identify over 50 bugs in macOS within three weeks, found their submissions refused due to the newly imposed limits. Alfredo Pesoli, Bynario’s chief executive, estimated the exploit’s value on the criminal market to be between $100,000 and $200,000. Apple has since stated it is in contact with Bynario and is reviewing their findings.
The challenge of managing AI-driven vulnerability reports is not unique to Apple. In March, security firm Bugcrowd observed a quadrupling of submissions over three weeks, with most proving to be fake. This trend prompted platforms like HackerOne and Nextcloud to suspend their paid programs in April, seeking methods to filter out low-effort, AI-generated content.
The increasing volume of reports is partly fueled by substantial rewards. In 2025, major companies like Meta, Microsoft, Apple, and Crypto.com collectively paid out at least $58 million for vulnerability findings, with Apple offering up to $5 million for a single discovery. Simultaneously, large language models (LLMs) are demonstrating enhanced capabilities in bug detection. Anthropic’s cyber-focused LLM, Mythos, introduced in March, helped Mozilla identify 271 vulnerabilities in Firefox during internal testing.
AI’s influence extends to exploit engineering as well. In May, security startup Calif developed a macOS kernel memory corruption exploit using an LLM preview, capable of bypassing Apple’s Memory Integrity Enforcement. Calif opted to deliver the exploit in person to Apple’s headquarters to bypass the “submission flood.”
Similar AI-driven discoveries are impacting the cryptocurrency sector. Coinkite indicated AI likely uncovered a five-year-old firmware bug that could have coincided with over $100 million in losses from its hardware wallets. Additionally, Zcash disclosed a vulnerability, found with Claude Opus 4.8, that allowed undetectable counterfeiting of ZEC for four years, now addressed by the Ironwood upgrade.
Apple’s experience highlights a critical challenge in cybersecurity: balancing the benefits of AI for threat discovery with the need to manage the overwhelming noise from AI-generated submissions. While Apple’s recent security updates credit AI software for surfacing flaws, the Bynario incident underscores the potential for security measures against AI-generated content to inadvertently impede the reporting of genuine threats. The industry faces an ongoing challenge to adapt its systems to effectively discern real vulnerabilities from AI-generated fabrications.
Why This Matters
This situation underscores the evolving landscape of cybersecurity, where the rapid advancement of AI presents both opportunities for discovery and significant challenges in managing vulnerability reports. Apple’s experience, where measures to combat AI-generated noise coincided with a real exploit potentially being missed, highlights a critical inflection point in how security vulnerabilities are discovered, reported, and managed. The core problem is distinguishing AI-generated noise from genuine security threats, a challenge that impacts the effectiveness of cybersecurity systems.
Broader Context
Apple’s decision to cap vulnerability reports follows a broader trend of security teams being swamped by AI-generated submissions. This influx, which includes fabricated flaws, has prompted companies to re-evaluate their disclosure processes. The market context involves substantial financial incentives for vulnerability findings, driving both legitimate research and the proliferation of AI-assisted or generated reports. The effectiveness of AI in both discovering and engineering exploits is a key factor shaping this evolving cybersecurity dynamic.
Leave a Reply